Privacy Policy
Last updated: 25 August 2026
Tenantree is property-management software. This policy explains what personal data the service handles, why, and for how long.
This document describes how the software actually behaves. It has not yet been reviewed by a Kenyan advocate. If you are relying on it for a compliance obligation of your own, have it reviewed first.
Who is responsible for what
If you are a landlord or agency using Tenantree, you are the data controller for the tenant, owner, occupant and caretaker records you enter. Tenantree is your data processor: we hold and process that data on your instructions, to run the service you have asked for.
For your own account data — your email address, your organisation, your billing — Tenantree is the controller.
What we hold
Your account. Email address, name, phone number, country, currency, timezone, hashed password, and where you supply them, a KRA PIN and tax-residency status. Passwords are hashed with bcrypt; we never store or display them.
People you record. Tenants, unit occupants, property owners and caretakers: name, phone number, email address, identity-document type and number, tenancy dates, and for caretakers, the photographs and GPS coordinates they submit as evidence of work done.
Money. Payment records, amounts, currencies, references and receipts; expense records; ledger entries; owner statements. Where a payment is made through M-Pesa, Paystack or Stripe, we store the reference that provider returns so the payment can be reconciled. We do not store card numbers, and Tenantree never holds or moves your money — payments settle directly between payer and payee on the provider's rails.
Technical. IP address and request metadata in server logs, a session cookie, and a CSRF token. We do not use advertising or analytics trackers.
Who else sees it
Only the processors needed to deliver a feature you have switched on:
| Processor | What it receives | Why |
|---|---|---|
| Resend | email address, message content | magic links, statements, receipts |
| Africa's Talking | phone number, message content | SMS reminders |
| Meta (WhatsApp Business) | phone number, message content | WhatsApp notifications |
| Safaricom (Daraja) | phone number, amount, reference | M-Pesa collection |
| Paystack / Stripe | payer contact, amount, reference | card and bank collection |
| Google Cloud | all hosted data | hosting (europe-west1) |
| KRA, via a licensed eTIMS integrator | invoice data | electronic tax invoices, where enabled |
We do not sell personal data, and we do not share it for anyone else's marketing.
How long we keep it
We keep records for as long as your organisation is active, and afterwards only where the law requires it.
Some retention periods are set by statute rather than by us. Tax records must be retained for the period the Tax Procedures Act requires. Where you operate licensed accommodation, the Tourism Regulatory Authority regulations require occupant details to be retained for not less than five years — Tenantree will not permanently delete those records before that period expires, even if you ask it to, because doing so would put you in breach.
Outside those obligations, deleting a record in Tenantree soft-deletes it first (recoverable from Trash) and then removes it permanently.
Your rights
Under the Data Protection Act 2019 you may ask for access to your personal data, correction of it, deletion of it, or a copy of it in a portable form, and you may object to processing or withdraw consent. Write to us and we will respond.
Where the data is held on behalf of a landlord or agency using Tenantree, we will pass your request to them, because they are the controller.
You may also complain to the Office of the Data Protection Commissioner.
Security
Traffic is encrypted in transit (HTTPS with HSTS). The application sets a strict Content-Security-Policy, and access to your organisation's data is scoped by organisation on every request. Passwords are hashed. Uploaded files are stored in object storage that is not publicly listable.
Contact
Reach us through your account, or through the contact details on the website you signed up from.